Cited by 1,392Network Security and Intrusion DetectionInternet of Things and AIIoT and Edge/Fog Computing

A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security

Open access
Al-Garadi, Mohammed Ali, Mohamed, Amr, Al-Ali, Abdulla Khalid, Du, Xiaojiang, Ali, Ihsan, Guizani, Mohsen·2020·IEEE Communications Surveys & Tutorials

Abstract

The Internet of Things (IoT) integrates billions of smart devices that can communicate with one another with minimal human intervention. IoT is one of the fastest developing fields in the history of computing, with an estimated 50 billion devices by the end of 2020. However, the crosscutting nature of IoT systems and the multidisciplinary components involved in the deployment of such systems have introduced new security challenges. Implementing security measures, such as encryption, authentication, access control, network and application security for IoT devices and their inherent vulnerabilities is ineffective. Therefore, existing security methods should be enhanced to effectively secure the IoT ecosystem. Machine learning and deep learning (ML/DL) have advanced considerably over the last few years, and machine intelligence has transitioned from laboratory novelty to practical machinery in several important applications. Consequently, ML/DL methods are important in transforming the security of IoT systems from merely facilitating secure communication between devices to security-based intelligence systems. The goal of this work is to provide a comprehensive survey of ML methods and recent advances in DL methods that can be used to develop enhanced security methods for IoT systems. IoT security threats that are related to inherent or newly introduced threats are presented, and various potential IoT system attack surfaces and the possible threats related to each surface are discussed. We then thoroughly review ML/DL methods for IoT security and present the opportunities, advantages and shortcomings of each method. We discuss the opportunities and challenges involved in applying ML/DL to IoT security. These opportunities and challenges can serve as potential future research directions.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/comst.2020.2988293

Cites

297 of 297 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Al-Garadi et al. [32] and Pakalapati et al. [33] provide strategic assessments of using AI/ML for threat detection and automated decision-making within DevSecOps pipelines, signalling the start of a broader movement toward intelligent, data-driven security automation.

    “Al-Garadi et al. [32] and Pakalapati et al. [33] provide strategic assessments of using AI/ML for threat detection and automated decision-making within DevSecOps pipelines, signalling the start of a broader movement toward intelligent, data-driven security automation.”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [32]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured
  • ML has been used mainly for intrusion detection, while DL for malware and anomalies detection in IoT security.

    “Among the potential surveyed applications, ML has been used mainly for intrusion detection, while DL for malware and anomalies detection.”

    From Deepfakes: current and future trends (2024) · cites this paper as Al-Garadi et al. 2020

    The Network layer section describes ML-based intrusion detection, while the Application layer describes DL-based malware detection and the RBMs section says deep models can detect network anomalies (page numbers unavailable in our copy). These examples support the applications named, but the survey also describes ML-based anomaly detection and does not establish that ML was used mainly for intrusion detection or DL mainly for malware and anomaly detection. (LLM, conf=0.84)

    Experimental — accuracy not yet measured
  • The review is primarily focused on IoT environments and does not directly address the integration of ML/DL into DevSecOps pipelines, which may limit its relevance for general DevSecOps practices.

    “The review is primarily focused on IoT environments and does not directly address the integration of ML/DL into DevSecOps pipelines, which may limit its relevance for general DevSecOps practices.”
  • There is a need for diverse datasets within IoT security.

    “As main conclusions, the authors claim the need for diverse datasets within IoT security.”

    From Deepfakes: current and future trends (2024) · cites this paper as Al-Garadi et al. 2020

  • Several security aspects shall be considered in every IoT system.

    “Several security aspects shall be considered in every IoT system (Al-Garadi et al. 2020):”

    From Deepfakes: current and future trends (2024) · cites this paper as Al-Garadi et al. 2020

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

1 retracted

Flagged first, then by citations

Research works printed but not linked: 12

  1. [32]32. C. Perera, A. Zaslavsky, P. Christen, and D. Georgakopoulos, "Context aware computing for the internet of things: A survey," IEEE communications surveys & tutorials, vol. 16, no. 1, pp. 414-454.
  2. [34]34. D. Zeng, S. Guo, and Z. Cheng, "The web of things: A survey," JCM, vol. 6, no. 6, pp. 424-438, 2011.
  3. [79]79. C. Karlof, N. Sastry, and D. Wagner, "TinySec: a link layer security architecture for wireless sensor networks," in Proceedings of the 2nd international conference on Embedded networked sensor systems, 2004, pp. 162-175: ACM.
  4. [121]121. S. Tong and D. Koller, "Support vector machine active learning with applications to text classification," Journal of machine learning research, vol. 2, no. Nov, pp. 45-66, 2001.
  5. [123]123. A. L. Buczak and E. Guven, "A survey of data mining and machine learning methods for cyber security intrusion detection," IEEE Communications Surveys & Tutorials, vol. 18, no. 2, pp. 1153-1176, 2015.
  6. [141]141. A. O. Adetunmbi, S. O. Falaki, O. S. Adewale, and B. K. Alese, "Network intrusion detection based on rough set and k-nearest neighbour," International Journal of Computing and ICT Research, vol. 2, no. 1, pp. 60-66, 2008.
  7. [162]162. N. M. Baba, M. Makhtar, S. A. Fadzli, and M. K. Awang, "Current Issues in Ensemble Methods and Its Applications," Journal of Theoretical and Applied Information Technology, vol. 81, no. 2, p. 266, 2015.
  8. [170]170. G. Münz, S. Li, and G. Carle, "Traffic anomaly detection using k-means clustering," in GI/ITG Workshop MMBnet, 2007.
  9. [181]181. I. Goodfellow, Y. Bengio, A. Courville, and Y. Bengio, Deep learning. MIT press Cambridge, 2016.
  10. [204]204. I. Goodfellow et al., "Generative adversarial nets," in Advances in neural information processing systems, 2014, pp. 2672-2680.
  11. [236]236. Y. Meidan et al., "ProfilIoT: a machine learning approach for IoT device identification based on network traffic analysis," in Proceedings of the Symposium on Applied Computing, 2017, pp. 506-509: ACM.
  12. [261]261. A. Lakhotia, A. Kapoor, and E. Kumar, "Are metamorphic viruses really invincible," Virus Bulletin, vol. 12, p. 57, 2004.

Cited by

Sorted by citations

Authors
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M.
Affiliations
  • Qatar University (QA)
  • Temple University (US)
  • University of Malaya (MY)
Venue
IEEE Communications Surveys & Tutorials
Published
2020
Volume
22
Issue
3
Pages
1646-1685
ISSN
  • 1553-877X (ISSN-L)
  • 2373-745X
OpenAlex
W2885012953
Cited by
1,392
References
294
Citations by year
2026: 170 · 2025: 234 · 2024: 232 · 2023: 237 · 2022: 213 · 2021: 217 · 2020: 75 · 2019: 13 · 2018: 1
FWCI
87.17
Type
journal article
Language
en
Open access
Locations
  • IEEE Communications Surveys & Tutorials (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • Qatar University QSpace (Qatar University) (submittedVersion)
  • arXiv (Cornell University)
Funders
NPRP from the Qatar National Research Fund (8-408-2-172, 12S-0305-190231)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
  • Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
Keywords
Internet of Things security, machine learning for security, deep learning for security, IoT security threats, attack surface, IoT vulnerabilities, intrusion detection, anomaly detection, authentication, access control, network security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review